This is an old problem, first reported in December 2001. 
The test case is a multithreaded application doing a large number of 
malloc()/free().

When running on a 16k page size kernel, the current algorithm creates
a temporary page, copies data to that page, does a new mmap and copies
back subpages from the temporary page. This leaves a window of opportunity
open for another thread to unmap or change the data in such a way that
the new page has stale data.

A patch was proposed which tries to do away with copying if the old page
was writable.  The patch was rejected because it could corrupt data in
the MAP_SHARED case.

https://external-lists.vasoftware.com/archives/linux-ia64/2001-December/002549.html
https://external-lists.vasoftware.com/archives/linux-ia64/2001-December/002550.html

Since we found that most of the apps which ran into this problem were
dealing with pages where the old data and new data are both anonymous,
I reworked the above patch in such a way that we don't optimize for
the MAP_SHARED case. Infact, the only case that we optimize is the case
where the old and new mapping are both anonymous.

	us from building the gate DSO in a way that makes it fit in
	<= 1 page. If a fixed linker is available, we do it in this
	space-saving way now. Otherwise, we'll do it the old way
	(the gate DSO will then take up about 18KB instead of just
	~3KB).  Thanks to Roland McGrath for making this all work.

- remove extra include of asm/perfmon.h
- fix a bug if PFM_LOAD_CONTEXT by which it would not return an
  error if the task already had a context attached.

  ia64: Rename FIXADDR_{START,TOP} to FIXADDR_USER_{START,END}.

  ia64: don't forget to establish coherence after vtop patching

      Remove CONFIG_FSYS option (it's the default now).
      Consolidate the various instruction patching routines into
      a single file (patch.c).

	.offsets.h.stamp.  Remove unused variable in acpi-ext code.

      This avoids polluting ia64 code with definitions that are correct for
      ia32 only (for example, the ELF-related definitions would otherwise
      collide with ia64 ELF definitions).

This patch fixes some NULL pointer
problems in perfmon.

 - fixes NULL pointer derefence in perfmon_mckinley.h when context is not
   loaded
 - fixes typo in pfm_write_pmcs()

Define ia64_max_iommu_merge_mask even without CONFIG_PCI,
so that the simulator can link.

I found the attached patch necessary to allow compressed file
systems to be used under the simulator.  lib/Kconfig is needed to
configure in the zlib routines.

Here is a patch to the ia64 Kconfig file that disables the
EARLY_PRINTK menu option if a GENERIC kernel is selected.

As we discussed last week, EARLY_PRINTK doesn't work for
GENERIC kernels because readb/readl are machvecs.

	so move it back to ptrace.h.

  ia64: NR_CPUS and number of CPUs

While building a kernel for our 4-way Lion box, I made the
mistake of setting NR_CPUS to 4.  Little did I know that the
Lion ACPI tables always list 8 CPUs (with only the first N
enabled), and so the resulting kernel overflowed the
smp_boot_data.cpu_phys_id array, crashed and burned.

fp assist.  The problem lies with concurrent, potentially frequent
updates of fpu_swa_count, which serves as the throttle for doing the
printk().  A frenzy of concurrent updates will produce a frenzy of
cacheline ping-ponging.

The fix is simple:

Only increment fpu_swa_count when the printk() is about to happen,
which limits the increment to no more than four times every five
seconds.

  ia64: no perfmon 2.5 fix

  ia64: cleaning up the INIT code

	In particular, this fixes a panic() in the IDE code which
	triggered on machines with IDE disks and memory above
	4GB.

	can escape include-hell.

This patch contains a major rewrite of the perfmon subsystem to
bring it to version 2.0. This version is NOT compatible with the
existing perfmon-1.x version which was in 2.5 and still is in 2.4
kernels. This new codebase brings a lot of new features including
the ability to attach to already running tasks, the ability the
follow clone2, the ability to write your own sampling buffer format
via kernel modules. It is also much more robust than its 1.x
counter-part. This version supports the Itanium, McKinley and
Madison PMUs. This is beta quality code and extensions to the
interface are planned.

Make the size of the user stack based on the stack rlimit.
The stack hard stack size now defaults to 2GB, but can be increased
 with ulimit up to 1/2 of the max mappable space in a region.
For 16k pages, this makes the max stack size 8TB.

I was getting annoyed at having to mess around with the HP Simulator
stuff when trying to compile generic kernels.  Here's the fix that I
came up with.  It basically makes the HP Sim console another config
option that depends on the HP sim serial code.

It also sticks a couple of run-time checks in the init functions to only
setup and run the code on hpsim machines.

This is a 2.5 version of the patch that I juggled around a couple of
weeks ago.  It's just a simple macro that allows one to check if the
kernel is running on a specific ia64 platform.

	left-over bits from the old task-creation/destruction hacks.  Fix typo
	in comment for pgprot_noncached().

	infrastructure.

	necessary.

The syscall optimization patches broke the OS INIT handler because
SAVE_RESET was addressing relative to r12, which contains the virtual
address of the stack pointer.  Fixed by addressing relative to r2/r3
instead.

Please find the attached patch that:

1. Moves user stack flag memory access before srlz.i;

2. Moves mov b6=r22 as late as possible. 

3. Changes (pSys) to (pLvSys) in skip_rbs_switch: section. IA32 syscall
set pSys=1 but pLvSys=0. It's not necessary to clear bank1 r16-r19 registers
for IA32 syscall.

The number for leave_syscall is 268 cycles with this patch. The number
is 295 cycles w/o this patch. It was 245 cycles with the original kee patched
kernel. The 23 cycles come from restoring b6 operation which didn't exist in
the orignal kee patch.

Only call get_scratch_regs() when pt is really needed.  The extraneous
calls to get_scratch_regs() can otherwise pick up the wrong address for pt.
For example, calling unw_access_ar(&info, UNW_AR_BSPSTORE,...) before pt_regs
had been reached could trigger this bug.

A bug-fix in IA-32 emulation ptrace code. The bug originally got
introduced with the addition of FPXREGS support in ptrace.

The bug is in ptrace get/set FPREGS routine. gdb by default will not use
FPREGS routines when FPXREGS routines are supported.  So we may not see
this bug during normal gdb operations. But, if gdb (or any other app)
directly tries to get/set FPREGS (probably an old version of gdb), it
will end with an segmentation fault due to this bug.

Attached patch fixes the issue. The patch is taken against 2.5.69. But
it applies to 2.4 tree as well.

the first patch  moves some definitions
out of perfmon.c to perfmon.h (similar to what is in 2.4). 

The second patch contains a fix for the generic built. I did 
it that way to avoid other problems such as SIMSCSI depends
on SCSI. so simply hardcoding this in the MAkefile could cause
other problems. Anyway, SIMSCI is not defaulting to y when
HP_SIM is defined so it is not so different.

Attached is a patch for interleaved discontigmem banks.

When memory banks are interleaved between nodes,
bank ids can be overwritten by other nodes.